Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/01/2025, 19:26

250130-x5yyfssmen 10

30/01/2025, 19:24

250130-x4cntssmcj 10

30/01/2025, 19:20

250130-x2afpaslfq 10

30/01/2025, 19:16

250130-xy5sesslcj 10

Analysis

  • max time kernel
    138s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2025, 19:16

Errors

Reason
Machine shutdown

General

  • Target

    http://youtube.com

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://youtube.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb56146f8,0x7ffeb5614708,0x7ffeb5614718
      2⤵
        PID:4360
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        2⤵
          PID:3824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3872
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
          2⤵
            PID:3608
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:3796
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
              2⤵
                PID:216
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                2⤵
                  PID:3104
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
                  2⤵
                    PID:4696
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
                    2⤵
                      PID:2748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5432 /prefetch:8
                      2⤵
                        PID:4640
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                        2⤵
                          PID:3600
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
                          2⤵
                            PID:1476
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4392
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
                            2⤵
                              PID:1392
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
                              2⤵
                                PID:4636
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                2⤵
                                  PID:3468
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                                  2⤵
                                    PID:2308
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                    2⤵
                                      PID:532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                                      2⤵
                                        PID:2988
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                                        2⤵
                                          PID:1980
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
                                          2⤵
                                            PID:3448
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
                                            2⤵
                                              PID:852
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                              2⤵
                                                PID:2988
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                                2⤵
                                                  PID:216
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6236 /prefetch:8
                                                  2⤵
                                                    PID:4696
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
                                                    2⤵
                                                      PID:1868
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
                                                      2⤵
                                                        PID:4924
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
                                                        2⤵
                                                          PID:2696
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                                          2⤵
                                                            PID:3396
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
                                                            2⤵
                                                              PID:5052
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4696 /prefetch:8
                                                              2⤵
                                                                PID:3956
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                                                2⤵
                                                                  PID:4812
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4936
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7155880395316327536,12378421588642291247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6780 /prefetch:2
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:548
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:212
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:3700
                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                    C:\Windows\system32\AUDIODG.EXE 0x344 0x3c4
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3420
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:4156
                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                      1⤵
                                                                        PID:3200
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:400
                                                                        • C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
                                                                          "C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
                                                                          1⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • UAC bypass
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops desktop.ini file(s)
                                                                          • Sets desktop wallpaper using registry
                                                                          • Drops file in Windows directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3348
                                                                        • C:\Windows\system32\LogonUI.exe
                                                                          "LogonUI.exe" /flags:0x4 /state0:0xa3904855 /state1:0x41c64e6d
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:948
                                                                        • C:\Windows\System32\rundll32.exe
                                                                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                          1⤵
                                                                            PID:2476

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            0504c0d0b9c007a767de8a404f2ec484

                                                                            SHA1

                                                                            73b1066ce283079341bc94a3e5c65535f0523145

                                                                            SHA256

                                                                            3469f4679beea250ce59f3fa4721e48f81587735f44e0fa2b70638b78dbf8a2d

                                                                            SHA512

                                                                            c6c0c6edbaab3b92832c4140916e99ca6725b79e5d3a43ad59ebd94a567458ef79923e2236b43344ecb6fd75442d0c7779b024edbd1bf9035a2a86ba7e5ce606

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            50236cd957789ed0d1b6564c7f0ecfae

                                                                            SHA1

                                                                            4c9e4dac57ab9ffb5bc55154d6ff89f1e6c1d5f4

                                                                            SHA256

                                                                            5820467c07d06249a1462b7c9deeb0801a8a6475ea19637397b9bbbc95f90fcd

                                                                            SHA512

                                                                            1cbf4be5224fecf811bf81361d6d282810de016194b17e2002d510287d384048272215b813838912eebcdddb1f657ade0aa3c122871c9d636b6a8fa8e74535d3

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                            Filesize

                                                                            244KB

                                                                            MD5

                                                                            56bcfc292f5b13f996bcd9e3894f8e9e

                                                                            SHA1

                                                                            ef6491aeb70e32284da1b9704a9073e9bfc8b6ca

                                                                            SHA256

                                                                            f9872892acf766ffef419d57e033927850e47ff2d1bd111d0ffd353aebc5f20e

                                                                            SHA512

                                                                            385f337347b9db945795d7e5bbd84c1de99d7263926edf495c78e461371ca21732f9e693a6040af303ee4369624514b9a0568c86ee6c5e0808ef7c5517cbc300

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                            Filesize

                                                                            50KB

                                                                            MD5

                                                                            94c3ea98765b412bf4585cbc355d5997

                                                                            SHA1

                                                                            00380137bd61e483736cbd65a572416eae27fdd0

                                                                            SHA256

                                                                            ce0e240e9d9f299402957d4d1b151f88e0f3198b70e1af0e6ac37a5468283a6a

                                                                            SHA512

                                                                            89f8d581a00b1222763595c93d4434730dc5c2f373761d41790da4b5e560c2ef9ee269c776aac31681efadf1255cb97ef1457436879d56c2efc4cfb0cbab494f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                                            Filesize

                                                                            642KB

                                                                            MD5

                                                                            6a0242fad8beb19a8f7f401526c2c2c9

                                                                            SHA1

                                                                            728f2d94db56f5d1d0b3f6d73e8575063e0458ec

                                                                            SHA256

                                                                            9412856a8a91eaf15ec2f2c39414648d5f4cc802b13951ab3263aa32a6e9b167

                                                                            SHA512

                                                                            4c22a1cb942930624f7186efda56fa1283ceb0c71d6b363f763d1db2fcd076de55f3d545ad324706e552c4c1262a0f3a96735e7b8cac69a6f229afbee7b3c87f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                            Filesize

                                                                            34KB

                                                                            MD5

                                                                            8223ae0c770c27b5159ffc75b0c9df86

                                                                            SHA1

                                                                            bc92f204ffff2324c2957182972fa52e1cc5ed61

                                                                            SHA256

                                                                            161e3d149cfa0feb2e4a06d225e60cb9392b4a0ec36c32483726bd5a2b9e6218

                                                                            SHA512

                                                                            e55e207d16fe3fe5ded504fdb21a6be93a92bbff682ae077fdd8163f6980084485b2cd6ea19000665fcf7d96fab0f29c66d014fca7da51fe61faba8f08ccb437

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                            Filesize

                                                                            34KB

                                                                            MD5

                                                                            e8832cfa464db3890c20cf33cd386185

                                                                            SHA1

                                                                            b2bb98c0b5a7914d638c39aa78fbe40ffa28e9a9

                                                                            SHA256

                                                                            6dddcd79a257c087acc58a12cb689cd1274f08900d7d91d7a27e5efe8bb02097

                                                                            SHA512

                                                                            73a63d2c74bc5ccbd5efe848bd0e3b77aad15ffa05dc52aec94fb3860a14b612c2e348c9145d814ec90bacea5ca013efe9e10fab15fd680f9b4bb353ea7feddb

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                                                            Filesize

                                                                            62KB

                                                                            MD5

                                                                            c813a1b87f1651d642cdcad5fca7a7d8

                                                                            SHA1

                                                                            0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                            SHA256

                                                                            df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                            SHA512

                                                                            af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                            Filesize

                                                                            67KB

                                                                            MD5

                                                                            69df804d05f8b29a88278b7d582dd279

                                                                            SHA1

                                                                            d9560905612cf656d5dd0e741172fb4cd9c60688

                                                                            SHA256

                                                                            b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                                                            SHA512

                                                                            0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                            Filesize

                                                                            63KB

                                                                            MD5

                                                                            226541550a51911c375216f718493f65

                                                                            SHA1

                                                                            f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                            SHA256

                                                                            caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                            SHA512

                                                                            2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                            Filesize

                                                                            19KB

                                                                            MD5

                                                                            1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                                            SHA1

                                                                            6dd8803e59949c985d6a9df2f26c833041a5178c

                                                                            SHA256

                                                                            af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                                            SHA512

                                                                            b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

                                                                            Filesize

                                                                            20KB

                                                                            MD5

                                                                            125a6fddddc610a54a39ac8913fc1667

                                                                            SHA1

                                                                            bb252bae3bf7432329956d4c3be0bbc34c3126be

                                                                            SHA256

                                                                            ffb47a81f0910bea45ff1fec7527523f625870ed20e895dcc711a7dc6095cfe3

                                                                            SHA512

                                                                            a04153f5ce517774c6ffc6a6f7c23b46000e40d8fdeec8ee92f2d88bbf9268863d449ddf1321da4460350bd7f2143cc255b948368960336c27ff847fffb6c9c1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

                                                                            Filesize

                                                                            20KB

                                                                            MD5

                                                                            4fa02ac6347763639aeb01d8adf287b2

                                                                            SHA1

                                                                            8cbf6b37f0cd329ba5b4f4f59437c55dd3057b37

                                                                            SHA256

                                                                            ec23a39504c8b289a6401723dd1a5153e9072e5f5beca20f88fac54ed3a477d9

                                                                            SHA512

                                                                            371e4b42152c578090254323dd4846df1ab38ac6bcff8ed6b67143dbfa5111c72e64366ac24b6ac04f3c405ce22e5f50f2a04e1805cce8b22ee8b95139a53afc

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            4KB

                                                                            MD5

                                                                            22eb4813b267ccbd6c84542108e53ce2

                                                                            SHA1

                                                                            5b09e98eb8898ffdb2d9942cf06ece8965040f78

                                                                            SHA256

                                                                            31bfd535df1970efe6583d4342df2588fabb1d6de29b8c2b3477935cf76f3441

                                                                            SHA512

                                                                            8d4c156a14a4ab51c1a69ce22730b314e967bc22982426242d771650ead7c2753179b0b52da8627e5c990eb4e13843c0c48a0fee5b2f1c291cde50e15e1ddb60

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            71e3bc71d94b66fcd12499b06c063c9f

                                                                            SHA1

                                                                            f06332fab577e892ed259f2e3968ca86d523c824

                                                                            SHA256

                                                                            4fd2a948525c1333d83c3abaaff4f3e29b048e371ae6afdc579ca3bf517033eb

                                                                            SHA512

                                                                            c20000c00281b3f072c9a619ab5b733752247129e2b19aee5755263b0713efc744a536ec884ca7d622c1f4f9e7335f80222ad70b37e4276a9be841aa4e9d51c5

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                            Filesize

                                                                            4KB

                                                                            MD5

                                                                            e8df3fd327fe975d5a17febcd1280685

                                                                            SHA1

                                                                            5d558826b54c4857bb858ac3980ca6899d12d8d1

                                                                            SHA256

                                                                            f3d0f8e3249b665a64f59598693149b89105827c707f29afc98584c9e7d3062c

                                                                            SHA512

                                                                            453e3561876721ded58f5233200c964345712a7c9be8fa624ca004dbd2c8415ec98cf09d45e5dbde2e6c071c60c3583433a03aba5f17395ab11bda77228240cb

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            7KB

                                                                            MD5

                                                                            dc9429f597948399779c86eb199930a1

                                                                            SHA1

                                                                            deab7b64c14c8bcc0e277f69f3467d1fca492d79

                                                                            SHA256

                                                                            8f5ce891196fc2b77f97cdb30f936b18b5df91a95423ea4b1b32255d6df4bc37

                                                                            SHA512

                                                                            83a806f67d4e9f70f2bbf6bce7cf2ab08abf2ddf32f659b25e48ffcbe6d2ebb67a73a345249a5426ef8cbd37655960213bc8e75e6a293fde41f4e31415b1bd72

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            72781b9f112ffd10e09ae19cefcc7845

                                                                            SHA1

                                                                            abb98d5a87116c3280492af00ab23e9cd294092d

                                                                            SHA256

                                                                            38eb7799352e95dbc619b9742a7af55e311e85271748476353c55799fc8dc22d

                                                                            SHA512

                                                                            6fd12ba3df47bd91847a02da2833460b0abe1fbaffb71d37300ca85d70a11e12304ce2e6e9b2822cccb0f3c15602dadb8e576142a9ab4772ca4a5e4f9b77b33f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            bb24bedc391895776c60ba470e30776c

                                                                            SHA1

                                                                            e8485b045399d2d692cf1f0a3b02497761134ead

                                                                            SHA256

                                                                            cc3b23cd5c39787d12db09259f950adbfaa3611618da1179a4ae93f4dc47e55c

                                                                            SHA512

                                                                            214f1baf5ca30254dc0c7d718025d4d5686efc705e808860df32374680fd34bd6a6df0a0c22c531802bb7813424ed07451e5cb6cffbc13e6c4f442af4c83c89d

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            20c8bbb5e611e3d7c4da3bcebff339cd

                                                                            SHA1

                                                                            074a79f513af8204989329dd74017ccb5cb2b803

                                                                            SHA256

                                                                            31eea0531ade8cbca678de865d9bfcc0893148b9835666bbcbffdd240eea0762

                                                                            SHA512

                                                                            168afef46e2bf2023d392b919bfc313166666e6939e181a9469612c82f59b3cd3a08a3f8f015ec91591f9c48c0c98aec8620d64d8aab139c0c61ef3157cc5909

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            82ecc4ebf8720dac14ba14012e666d5b

                                                                            SHA1

                                                                            9b6dd3ee0ce284379e416e07c95385f026d2cb12

                                                                            SHA256

                                                                            1681700e0a684d3ac9e952c5e07e62c65b18d7270e9e419bf5a38c9313559797

                                                                            SHA512

                                                                            2190d3f88481ea17f9c2c0673f4dbf96fdeb0f7d097e7af30f5e76451a4802166c6ac8523234be09cfdd230ae22992630240962b2a614756090acd69c75c3fbc

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            99871810c8f306de002762a79b7feca3

                                                                            SHA1

                                                                            2aec5e2640402d8f8cca2dec1a23077a1f5fbe9c

                                                                            SHA256

                                                                            24bedbb58d49870be8120ae3c67edc54bd81494a6ddcb55305195f97e614da64

                                                                            SHA512

                                                                            55b0aaf7e7aaaa24233c3ef3707463b8a5d796e469575d03c681fcc463053464f6ce5020fd50f288594f1eabef0d018141cc116079621d8c445e2a652339fbcd

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8c3a3bba-b355-402c-a9a7-a831455da40a\index-dir\the-real-index

                                                                            Filesize

                                                                            624B

                                                                            MD5

                                                                            40d4fde4d62146db7150b3f9a20a16cd

                                                                            SHA1

                                                                            99c8019a8b8103a059b2eff6719e07c83746f5aa

                                                                            SHA256

                                                                            5bf7ffb2c3bbae5625c0c71d8079ebcf417bb975ed9eb036586be177174301da

                                                                            SHA512

                                                                            d5ccf4fff8844f390a148b8d01407c1b4737dd10efb5ed79cfbd59d4845757c3c3e84982eebecff4e0551647f49c74a4072fad062d443a843b9734e49b9d2051

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8c3a3bba-b355-402c-a9a7-a831455da40a\index-dir\the-real-index~RFe57ff8e.TMP

                                                                            Filesize

                                                                            48B

                                                                            MD5

                                                                            80eae2d2d3ada69ddc2ddf013471f0a2

                                                                            SHA1

                                                                            c30e16675bd38efb6a456dec13655a77a42c253d

                                                                            SHA256

                                                                            0b0c74c34191d418b83170c40ca4273274edac05839a2565715a5657044aeecf

                                                                            SHA512

                                                                            a5fe87d206172fc43dd714fbcd2863255dfbe4b6a62c343348cc88427c0721be34ed73bb5e10bd88a8ed5028b1b57847191323cbf918bd0aa1619e97a4771240

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\acff6f46-423b-4634-bffe-ec1407165b78\index-dir\the-real-index

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            2f88db433f1377592c46c7e3cd43e542

                                                                            SHA1

                                                                            dc124a8b735ec13833f68191e2968b2212cddb34

                                                                            SHA256

                                                                            6ba6463d612a852e747173c4a54d744b4927a09c09070ec4fb7a5069948e2b49

                                                                            SHA512

                                                                            4d90f9541061225dfe2259f634c0522f11d6821d30806102e1cce961574a482a56600bd6c3fd42a1723f3ded52d0d3d994d5bdf1521db015f1a2597f1f597366

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\acff6f46-423b-4634-bffe-ec1407165b78\index-dir\the-real-index~RFe57a604.TMP

                                                                            Filesize

                                                                            48B

                                                                            MD5

                                                                            993be6faa90dcd4fdc1b3d132447f829

                                                                            SHA1

                                                                            440523567c9930e2b6cf0010137c530604260ad4

                                                                            SHA256

                                                                            b2706ffa899d2b42361c5ec83e18f961b415238ddd3c1e2b7439d29a2891e961

                                                                            SHA512

                                                                            257ba8349edd89504cb2cb5bf29382d238024f39cc896b2c5396ce9cfb5cd07d773411c5a09fc1a7e03f47926b8755b1c0a6aa86f81ab6a0ec24d67385281b43

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\de44a369-2d3a-4d55-b575-6f9bfd503b0b\index

                                                                            Filesize

                                                                            24B

                                                                            MD5

                                                                            54cb446f628b2ea4a5bce5769910512e

                                                                            SHA1

                                                                            c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                                            SHA256

                                                                            fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                                            SHA512

                                                                            8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            157B

                                                                            MD5

                                                                            2f83109f14a1cb371ebf9ad3ecd60f91

                                                                            SHA1

                                                                            72ab718b5235e1f18aefcdd174a677c4902a1e0d

                                                                            SHA256

                                                                            756fb2107a565eac012094fa2240eab1c586a54bc59478d4451fa81b86df1e69

                                                                            SHA512

                                                                            aa743e6e1cf6bef509a1c44419b7cbd68259378e77dd8b6f31fb581a904422b3985669f6df26da4c6a781fd8a0220c95a46cbc32ac9d00783260d40b0533cd49

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            89B

                                                                            MD5

                                                                            d5278598a587c007dd493d6c99f51b8a

                                                                            SHA1

                                                                            83354eca4afe024ad2b063148ec3c30d9aaf3777

                                                                            SHA256

                                                                            4c90d080931e847a9c99482894f11c13740a51e83dbea1a141e8c3af81e39574

                                                                            SHA512

                                                                            00d862161a4735990039d45e86daacbe568a139b6c6d7e5546f35a87167131e5191bed558e5d9e5d5e91c0030c242a77ee269dc3bd77a7ccc0cb30e4c1d9bd4e

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            146B

                                                                            MD5

                                                                            0e80c7cd429fbacf22ea26e0abef6911

                                                                            SHA1

                                                                            198967177a2a770a65a0eda993e663811ea48111

                                                                            SHA256

                                                                            8ae4e57217a5a9eaed0f8fac01b9b1838f8ed7135327f28ce27bb6a428344f37

                                                                            SHA512

                                                                            865bad312145ef12200cb3daa7a9eaddc73142c74f833b24e56226a2e38e1420f8e7fa25f58188e86823afa8a946c3da4b16a773afffdde5d4c6cf1615a31dca

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            153B

                                                                            MD5

                                                                            e117b4401b6ef72620f0aa6203e9ae77

                                                                            SHA1

                                                                            4ab375c802eb57a27bc5bcc1848b492834218a51

                                                                            SHA256

                                                                            c04a3fcecada3f9babb937bde7340a0736037e832ea9839af25dba251a8212ab

                                                                            SHA512

                                                                            3a00539b4651a7f21cce781f47e0e62147b5c063cd79d186c9ca349ef085a6a3ad123be5496158a92abd45a307c3c6069d4f33f7ea20af21b58e65e7bddbf9c1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            82B

                                                                            MD5

                                                                            cad391ca57624f2ca751c63f6c1bf0ef

                                                                            SHA1

                                                                            29a3983ac24c03b895319427ffe3c3866453864f

                                                                            SHA256

                                                                            8b2720b47262a9839a274e8b7722315f8be81252947a3ffe5cec8a4ed7bbf35c

                                                                            SHA512

                                                                            939a05596f8f2cfdf4716c6cf5c4d1da6b4dbd78c1a5c1ce27d010d471a897a8181168c84799a70d2c4b2462f493b40444745202924f5f920fd4d81160c0d3e0

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            148B

                                                                            MD5

                                                                            64b15e144981181dac33af4f7242b5e1

                                                                            SHA1

                                                                            47112db51b080eaf531a1db80ed39122ed6d0d9b

                                                                            SHA256

                                                                            dc7266dff3f6b9d4bd58f9fac8e01f69eb483708bd598ea2dde860cc1b14a97a

                                                                            SHA512

                                                                            6919c53627efc9c04f97e0bb6e220d2f3560b872741c3de27e9c04af8d803df283b6a4b540dda0903fb3a38b7072dc7c23b2e51adeb59bcf35057faf7581cf50

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                            Filesize

                                                                            84B

                                                                            MD5

                                                                            c78c2775ee3ddee808f4bafd5c4f7ead

                                                                            SHA1

                                                                            ce5b7368872aae773c079013222b04b405e4149a

                                                                            SHA256

                                                                            144ff2072e587645b606314edf5cac2c4c5c14b6feb6fd61b01679a6bbf4ced6

                                                                            SHA512

                                                                            2c8486fe8290af655ba687bf2f91904240d5567864f61ddeb6b1d48eae12024ed762a7c6f8bc720a2720391a82001223db90c69d75cdb4bf498f9240462b6624

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                            Filesize

                                                                            16B

                                                                            MD5

                                                                            46295cac801e5d4857d09837238a6394

                                                                            SHA1

                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                            SHA256

                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                            SHA512

                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                            Filesize

                                                                            96B

                                                                            MD5

                                                                            8b2dc273ebcdabd1559e9aa31081dd00

                                                                            SHA1

                                                                            03a7baa297213c1258cdcde1c105cb0bb952d462

                                                                            SHA256

                                                                            44abcc70b4bce52dc79ae0045a41883b886f3300d0b77c8ed3739f452841af76

                                                                            SHA512

                                                                            0fe9b78bf7532c58da671fe13316c9b2f96d2d52045abe4d945b0bacf3520f2da8945b0840072e36ed676ad6a896a3a31d7dafbd5ca986c1e4b7b69e9332b865

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f8c7.TMP

                                                                            Filesize

                                                                            48B

                                                                            MD5

                                                                            f5943e1734d176cb00cc62e34d83b1c6

                                                                            SHA1

                                                                            c6db3f34115c9dec2118e6cc8fd5f6ddb3bd434c

                                                                            SHA256

                                                                            677e16741a65d81dbf681a219409616df8166c635447ebc0aa9343f79a38c7db

                                                                            SHA512

                                                                            dae4e193abe40b7f2c3333de12936d8016c6fcfdd039d7db43f1945e632daae94eba8cf9e114a13130fc074244badc8af0de2c72d0132769fbfb9bf50bdf5f55

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            2b1b16c3710d4e879d4cd46899d5bcf9

                                                                            SHA1

                                                                            e54b77b0d9eaeacbd3f957f551098f6ab7070bda

                                                                            SHA256

                                                                            81bd274f5f1364a4224b347568fd84fd8cc284fef444798da3ac249d554eadf5

                                                                            SHA512

                                                                            4b7d18abbbb7c46a6563b88eb7f69a7b2ebdfa72282e754f83a862e72d5a0ab2d5955cacd7f971f74df27812409f0ec0f9cb71efcf5cf232ff4ee115520e345a

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            24c47d2924e9190a1fb5d0da36221cd2

                                                                            SHA1

                                                                            aba91218a613ffee968360b513c744fee2294a93

                                                                            SHA256

                                                                            77ca2723c5a379c85e2fad0c758bbfa536d685fe28b4c64732f772ab81ceacab

                                                                            SHA512

                                                                            36e8c2396c09f415f9fda33bb2ba4d6d3ad6f9a3044d2925261d39e7b142ed6e7fcc8419cd0a243a383536301e37f5f73f8012ba77af00b3027caf25fabbbdde

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            e8ff91aacb73690b8c51e1c1b2581c08

                                                                            SHA1

                                                                            81be9e77c82d152d5a19523ce96a2fc15823c4ab

                                                                            SHA256

                                                                            f5c3e5538395350aa94b5c3ec51ad747febb246d0b1ea30eea47dc58fa20af33

                                                                            SHA512

                                                                            32745bca465229846608c3e8a49a71a27095e6711f9dfaa2b793bbcebd1d0e3789b303146569720a67f653bdc2265abded253a1c8f1fa55e5650e088672aca03

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            e5bb87c7643a11e6a3c70dcd95696b4d

                                                                            SHA1

                                                                            1b6e7fa7ed2b8b8f217d2ba07689d71fb1d071cb

                                                                            SHA256

                                                                            49d588a6fa4456698b28a66220b4c0b09b5ef0fb24370749a0322623d58d370d

                                                                            SHA512

                                                                            466c4f51ee92ee6fe8b747af75ca37e460f96180051a9f7aa3f08f827229ae48ca36244c247d657e6bf93918664fa549f53331d51cc5e0b2f8b00bbbde6ee988

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            69dea0f02f1dda625a585de37945fc8e

                                                                            SHA1

                                                                            0686ed4c5fb5f7f0a961f85aa9a3bddc1ade99ca

                                                                            SHA256

                                                                            79233a59e50e56086b6175a8532ccd5f958532ab9d43dde084371c4a7699767b

                                                                            SHA512

                                                                            7a52074e47807776801f51c3ec0d1bc26e2c0ad5d8b69e2fc4764884d0550b2edbf27fa6168e639b179b5f24f70d37690942d18b596829f70ea3e3f2a73684b2

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            b68995a8a8ed0262a15756db7fbbfde4

                                                                            SHA1

                                                                            7047e0bcc441d269b8b0cad661e38cb0565233b5

                                                                            SHA256

                                                                            7fcc1b72042620d381f5a807bc858c8d4c106e282ad6390089007bdf36069760

                                                                            SHA512

                                                                            234cc5305781c3b431941db53ed68e4f5cfc9168d3d44a2e47793c9375073cbe9a40c4773a99618d1794b7f7e3c470375a58c69610e691e0471975b9487a2841

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f155.TMP

                                                                            Filesize

                                                                            706B

                                                                            MD5

                                                                            7144ddca439931c5d3b4bfc8208fcb02

                                                                            SHA1

                                                                            84db014c3b8bd2a9971cc25c2605c7d92e7db883

                                                                            SHA256

                                                                            e2217832c922d80eda3ee2e5b68f486688f45f9de2b1b8462cd5bede9d6df47c

                                                                            SHA512

                                                                            96ef51ea35e6bf4c710e7eaa156f5af4322cfbb84e6c1d952e0508d575f0163560c3b87295511fe442816306199ecbfd42d0a6b1ac6a901fa27517dbeee4d551

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                            Filesize

                                                                            16B

                                                                            MD5

                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                            SHA1

                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                            SHA256

                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                            SHA512

                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            3ba411618a19fab8e0e49baf74438bae

                                                                            SHA1

                                                                            a0ab4b719d76310833993d73e5975d5bbb0b141c

                                                                            SHA256

                                                                            2e9a9de65513fc50256eb7460f98d2368139fdf3fb4a9868bd03993b113606a6

                                                                            SHA512

                                                                            23a1b7ce813c36918680821374b58fc27abd9fd1c761181cabaf8e0d5a9f1454e9b2b0330c723dc28d95cb4797b1f02d63006e039c9d71a1f04322de18c9ff1f

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            b8fe1f72f7ce53fe496783a26dbe0a09

                                                                            SHA1

                                                                            8fb0ee413e4185285f0ee4ccd7574c56e1351b14

                                                                            SHA256

                                                                            c9a90b16f54f54cdf4be3d901777fbd2758013de42caffb7158ecd250d2714a9

                                                                            SHA512

                                                                            bf4d5b556f978e989cff787f4602864fbad8ba7257d39d478f78b4955f291779d84947faed743f717c2ede9f78e72233e665a93db19f1d4cc8da76bde8505098

                                                                          • C:\Users\Admin\Downloads\NoEscape.zip

                                                                            Filesize

                                                                            616KB

                                                                            MD5

                                                                            ef4fdf65fc90bfda8d1d2ae6d20aff60

                                                                            SHA1

                                                                            9431227836440c78f12bfb2cb3247d59f4d4640b

                                                                            SHA256

                                                                            47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

                                                                            SHA512

                                                                            6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

                                                                          • C:\Users\Public\Desktop\ᬏ↑⃾ܼ⡊ᏊὙ␆⹭ᣣ⠱๷مὖ⟢ᩴⵔ⪏⽔⾫ବՁᴚഝᏛրಐ

                                                                            Filesize

                                                                            666B

                                                                            MD5

                                                                            e49f0a8effa6380b4518a8064f6d240b

                                                                            SHA1

                                                                            ba62ffe370e186b7f980922067ac68613521bd51

                                                                            SHA256

                                                                            8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

                                                                            SHA512

                                                                            de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

                                                                          • memory/3348-1281-0x0000000000400000-0x00000000005CC000-memory.dmp

                                                                            Filesize

                                                                            1.8MB

                                                                          • memory/3348-1458-0x0000000000400000-0x00000000005CC000-memory.dmp

                                                                            Filesize

                                                                            1.8MB